# Anomaly detection record score error

**URL:** <https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-machine-learning\
**Created:** [May 11, 2022, 2:20am UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403 "2022-05-11T02:20:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zerojin63](https://avatars.discourse-cdn.com/v4/letter/z/97f17d/32.png) [@zerojin63](https://discuss.elastic.co/u/zerojin63)\
**Post date:** [May 11, 2022, 2:20am UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403/1 "2022-05-11T02:20:35Z")

</div>

Hi,  
I've got a question regarding the scoring system of ELK anomaly detection.

I've been running a job with 'high\_sum' detector, and there was an anomaly with record score 99 but actual value of the sum of the field was 0.  
The field the detector referst to is 'bytes' so 0 is the smallest value.

It's clearly not a high\_sum anomaly, still such thing (detecting buckets with actual value=0 as high anomaly) happens time to time.

Does anyone happen to know why such error occurs?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 11, 2022, 6:00pm UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403/2 "2022-05-11T18:00:37Z")

</div>

Hmm...this sounds familiar to a bug that may have been recently fixed. Can you tell us what version you are currently using?

---

<div class="post-metadata">

**Author:** ![zerojin63](https://avatars.discourse-cdn.com/v4/letter/z/97f17d/32.png) [@zerojin63](https://discuss.elastic.co/u/zerojin63)\
**Post date:** [May 12, 2022, 12:43am UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403/3 "2022-05-12T00:43:07Z")

</div>

I'm using v 7.16.3.  
Thanks for your reply.

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [May 16, 2022, 9:54am UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403/4 "2022-05-16T09:54:22Z")

</div>

If possible, I recommend you upgrade to the latest (v8.2) as there have been several bug fixes in this area since 7.16. There were cases where the modeling would have stability issues (a big spike followed by several empty bucket spans, for example).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2022, 9:55am UTC](https://discuss.elastic.co/t/anomaly-detection-record-score-error/304403/5 "2022-06-13T09:55:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.